CVE-2026-102496

A flaw was found in Apache XMLSchema. When constructing its schema model, the parser does not restrict how deeply schema structures can be nested. A remote attacker could exploit this vulnerability by providing a crafted XML schema containing deeply nested elements, triggering uncontrolled...

CVE-2026-102495

A flaw was found in Apache XMLSchema. The parser does not properly restrict how deeply schema imports and includes can be nested during processing. A remote attacker could provide a crafted schema with deeply nested references, triggering unbounded recursion that exhausts the call stack. This fla...

CVE-2026-102495

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

CVE-2026-102496

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

CVE-2026-102497

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

EUVD-2026-88739

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

CVE-2026-102497

The Apache XmlSchema walker (xmlschema-walker) is vulnerable to a Denial of Service (DoS) because it fails to detect cycles in type derivation, substitution groups, model groups, or attribute groups. A malicious schema containing such cycles can cause the walker to recurse infinitely until a stac...

CVE-2026-102497 Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker

The Apache XmlSchema walker xmlschema-walker doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A malicious schema with such a cycle can make the walker recurse until the stack overflows, causing a denial of service. Users are recommended to upgrade t...

CVE-2026-102496 Apache XMLSchema: Denial of service through deeply nested schema structures

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

CVE-2026-102496

The Apache XmlSchema library is vulnerable to a denial of service due to a lack of limits on how deeply schema structures can be nested during model building. A malicious schema can trigger recursive parsing until a stack overflow occurs. To mitigate this issue, users are recommended to upgrade t...

EUVD-2026-88738

Apache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

CVE-2026-102495

Apache XmlSchema is vulnerable to a denial of service due to unbounded recursion when resolving schema imports and includes. A malicious schema can cause the parser to recurse until a stack overflow occurs. Users are recommended to upgrade to version 2.3.3 to resolve this issue. No specific explo...

EUVD-2026-88737

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...

CVE-2026-102495 Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes

Apache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack overflows. This causes a denial of service. Users are recommended to upgrade to version 2.3.3, which fixes this issue...